rte_security.h

Go to the documentation of this file.

/*-
 *   BSD LICENSE
 *
 *   Copyright 2017 NXP.
 *   Copyright(c) 2017 Intel Corporation. All rights reserved.
 *
 *   Redistribution and use in source and binary forms, with or without
 *   modification, are permitted provided that the following conditions
 *   are met:
 *
 *     * Redistributions of source code must retain the above copyright
 *       notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above copyright
 *       notice, this list of conditions and the following disclaimer in
 *       the documentation and/or other materials provided with the
 *       distribution.
 *     * Neither the name of NXP nor the names of its
 *       contributors may be used to endorse or promote products derived
 *       from this software without specific prior written permission.
 *
 *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef _RTE_SECURITY_H_
#define _RTE_SECURITY_H_

#ifdef __cplusplus
extern "C" {
#endif

#include <sys/types.h>

#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>

#include <rte_compat.h>
#include <rte_common.h>
#include <rte_crypto.h>
#include <rte_mbuf.h>
#include <rte_memory.h>
#include <rte_mempool.h>

enum rte_security_ipsec_sa_mode {
        RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT = 1,
        RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
};

enum rte_security_ipsec_sa_protocol {
        RTE_SECURITY_IPSEC_SA_PROTO_AH = 1,
        RTE_SECURITY_IPSEC_SA_PROTO_ESP,
};

enum rte_security_ipsec_tunnel_type {
        RTE_SECURITY_IPSEC_TUNNEL_IPV4 = 1,
        RTE_SECURITY_IPSEC_TUNNEL_IPV6,
};

struct rte_security_ctx {
        void *device;
        const struct rte_security_ops *ops;
        uint16_t sess_cnt;
};

struct rte_security_ipsec_tunnel_param {
        enum rte_security_ipsec_tunnel_type type;
        RTE_STD_C11
        union {
                struct {
                        struct in_addr src_ip;
                        struct in_addr dst_ip;
                        uint8_t dscp;
                        uint8_t df;
                        uint8_t ttl;
                } ipv4;
                struct {
                        struct in6_addr src_addr;
                        struct in6_addr dst_addr;
                        uint8_t dscp;
                        uint32_t flabel;
                        uint8_t hlimit;
                } ipv6;
        };
};

struct rte_security_ipsec_sa_options {
        uint32_t esn : 1;

        uint32_t udp_encap : 1;

        uint32_t copy_dscp : 1;

        uint32_t copy_flabel : 1;

        uint32_t copy_df : 1;

        uint32_t dec_ttl : 1;
};

enum rte_security_ipsec_sa_direction {
        RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
        RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
};

struct rte_security_ipsec_xform {
        uint32_t spi;
        uint32_t salt;
        struct rte_security_ipsec_sa_options options;
        enum rte_security_ipsec_sa_direction direction;
        enum rte_security_ipsec_sa_protocol proto;
        enum rte_security_ipsec_sa_mode mode;
        struct rte_security_ipsec_tunnel_param tunnel;
        uint64_t esn_soft_limit;
};

struct rte_security_macsec_xform {
        int dummy;
};

enum rte_security_session_action_type {
        RTE_SECURITY_ACTION_TYPE_NONE,
        RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
        RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
        RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
};

enum rte_security_session_protocol {
        RTE_SECURITY_PROTOCOL_IPSEC = 1,
        RTE_SECURITY_PROTOCOL_MACSEC,
};

struct rte_security_session_conf {
        enum rte_security_session_action_type action_type;
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct rte_security_ipsec_xform ipsec;
                struct rte_security_macsec_xform macsec;
        };
        struct rte_crypto_sym_xform *crypto_xform;
        void *userdata;
};

struct rte_security_session {
        void *sess_private_data;
};

struct rte_security_session * __rte_experimental
rte_security_session_create(struct rte_security_ctx *instance,
                            struct rte_security_session_conf *conf,
                            struct rte_mempool *mp);

int __rte_experimental
rte_security_session_update(struct rte_security_ctx *instance,
                            struct rte_security_session *sess,
                            struct rte_security_session_conf *conf);

unsigned int __rte_experimental
rte_security_session_get_size(struct rte_security_ctx *instance);

int __rte_experimental
rte_security_session_destroy(struct rte_security_ctx *instance,
                             struct rte_security_session *sess);

int __rte_experimental
rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
                              struct rte_security_session *sess,
                              struct rte_mbuf *mb, void *params);

void * __rte_experimental
rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md);

static inline int __rte_experimental
__rte_security_attach_session(struct rte_crypto_sym_op *sym_op,
                              struct rte_security_session *sess)
{
        sym_op->sec_session = sess;

        return 0;
}

static inline void * __rte_experimental
get_sec_session_private_data(const struct rte_security_session *sess)
{
        return sess->sess_private_data;
}

static inline void __rte_experimental
set_sec_session_private_data(struct rte_security_session *sess,
                             void *private_data)
{
        sess->sess_private_data = private_data;
}

static inline int __rte_experimental
rte_security_attach_session(struct rte_crypto_op *op,
                            struct rte_security_session *sess)
{
        if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC))
                return -EINVAL;

        op->sess_type =  RTE_CRYPTO_OP_SECURITY_SESSION;

        return __rte_security_attach_session(op->sym, sess);
}

struct rte_security_macsec_stats {
        uint64_t reserved;
};

struct rte_security_ipsec_stats {
        uint64_t reserved;

};

struct rte_security_stats {
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct rte_security_macsec_stats macsec;
                struct rte_security_ipsec_stats ipsec;
        };
};

int __rte_experimental
rte_security_session_stats_get(struct rte_security_ctx *instance,
                               struct rte_security_session *sess,
                               struct rte_security_stats *stats);

struct rte_security_capability {
        enum rte_security_session_action_type action;
        enum rte_security_session_protocol protocol;
        RTE_STD_C11
        union {
                struct {
                        enum rte_security_ipsec_sa_protocol proto;
                        enum rte_security_ipsec_sa_mode mode;
                        enum rte_security_ipsec_sa_direction direction;
                        struct rte_security_ipsec_sa_options options;
                } ipsec;
                struct {
                        /* To be Filled */
                        int dummy;
                } macsec;
        };

        const struct rte_cryptodev_capabilities *crypto_capabilities;
        uint32_t ol_flags;
};

#define RTE_SECURITY_TX_OLOAD_NEED_MDATA        0x00000001

#define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD      0x00000002

#define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD      0x00010000

struct rte_security_capability_idx {
        enum rte_security_session_action_type action;
        enum rte_security_session_protocol protocol;

        RTE_STD_C11
        union {
                struct {
                        enum rte_security_ipsec_sa_protocol proto;
                        enum rte_security_ipsec_sa_mode mode;
                        enum rte_security_ipsec_sa_direction direction;
                } ipsec;
        };
};

const struct rte_security_capability * __rte_experimental
rte_security_capabilities_get(struct rte_security_ctx *instance);

const struct rte_security_capability * __rte_experimental
rte_security_capability_get(struct rte_security_ctx *instance,
                            struct rte_security_capability_idx *idx);

#ifdef __cplusplus
}
#endif

#endif /* _RTE_SECURITY_H_ */